package cn.ivicar.mapper.utils;

import java.util.regex.Pattern;
import org.apache.log4j.Logger;

public class AntiInjection {
    private static Logger logger = Logger.getLogger(AntiInjection.class);
    
    /**
     * @param queryParam
     * @return 检测结果，0表示不通过，1表示通过
     */
    public static boolean check(String queryParam) {
        return checkOr(queryParam)&&checkUnion(queryParam);
    }

    public static boolean checkOr(String sql) {
        String orReg = "((\\s)*or(\\s)+)";
        Pattern p =  Pattern.compile(orReg);
        boolean flag =  p.matcher(sql).find();
        logger.debug("检测是否包含OR ["+flag+"]");
        if(flag){
            logger.info("["+sql+"]中包含 or 请检查参数是否正确");
        }

        return !flag;
    }
    
    public static boolean checkUnion(String sql){
        String unionReg = "((\\s)*union(\\s)+)";
        Pattern p =  Pattern.compile(unionReg);
        boolean flag =  p.matcher(sql).find();
        logger.debug("检测是否包含union ["+flag+"]");
        if(flag){
            logger.info("["+sql+"]中包含 union 请检查参数是否正确");
        }

        return !flag;
    }
}
